---
schema_version: "1"
id: 69b11d0b9b970a66b1200dad51f3a56d8b640dc70ba77d927ebe73630a904b57
title: Adding a Scanner for Kong Gateway
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/exchange/adding-kong-gateway-scanner.md
canonical_url: https://docs.mulesoft.com/exchange/adding-kong-gateway-scanner
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 6bb8d85998c2594a0ea02fff12585939ad1ffabab1125d6b38037ebfa4b4b7b1
description: MuleSoft Documentation Site
latest: true
---
---
product: Exchange
---

# Adding a Scanner for Kong Gateway

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange and to
discover and read policies from API configurations. Once imported, you can apply governance rulesets
and publish them to your developer portal.

In Kong, policies are called plugins. The scanner discovers plugins attached to Kong Gateway
services and routes, and the enhanced MuleSoft experience shows those discovered plugins as
policies. Plugins applied directly at the service instance level are not currently scanned.

## Before You Begin

Before adding the scanner, verify that you have these prerequisites:

- Exchange Administrator permission

- Kong Control Plane Viewer permission

- Kong Gateway region

- Personal access token (PAT)

Credential scope required for discovering and reading policies:

- Kong Admin API read

Setup for OpenAPI Specifications:

Before you run the scanner, link each Kong Gateway service to a Catalog API that has an attached
OpenAPI Specification (OAS) so that discovery produces accurate, typed API definitions. For the
required workflow and route-discovery limitations, see
[OpenAPI Specifications](#kong-gateway-scanner-openapi-specifications).

## OpenAPI Specifications

To discover accurate, typed API definitions from Kong Gateway, link each Kong Gateway service to a
Catalog API that has an attached OpenAPI Specification (OAS). The scanner reads the OAS from the
linked Catalog API to build a complete, typed service definition.

Uploading an OAS file directly to a Kong Gateway service only creates Kong routes—it doesn’t store a
spec or endpoint definition that the scanner can read. Without a Catalog-linked spec, Kong infers
routes from the gateway configuration. Inferred routes are untyped and produce a lower-quality
service definition and degraded MCP bridging.

To attach an OAS so the scanner can read it:

1.  In the Kong **Catalog** section, create an API.

2.  Attach the OAS spec to the Catalog API.

3.  Link the Catalog API to a gateway service in Kong Gateway.

For more information, see the
[Kong API catalog documentation](https://developer.konghq.com/api-catalog/).

> [!NOTE] If a Kong Gateway service isn’t linked to a Catalog API with an attached OAS, only the
> first route per path is discovered. For example, if the `/items` path has both `GET` and `POST`
> routes, only one of those routes appears in the discovered definition. Link the service to a
> Catalog API with an attached OAS to discover all routes and methods for each path.

## Add a Scanner for Kong Gateway

1.  Verify that you are in the business group where you want to add the scanner.

2.  From the sidebar in Exchange, click **Scanners**.

3.  Enter a name for the scanner.

4.  From **Scanner Run Configuration**, complete these fields or options:

    <table><colgroup><col> <col></colgroup><thead><tr><th><strong>Field/Option</strong></th><th><strong>Value</strong></th></tr></thead><tbody><tr><td><p><strong>Run Schedule</strong></p></td><td><p>Select a frequency and local time.</p></td></tr><tr><td><p><strong>Sync Review</strong></p></td><td><p>Select an option: <strong>Auto-resolve</strong> or <strong>Ask to review</strong>.</p></td></tr></tbody></table>

5.  From **Connection Configuration**, complete these fields:

    <table><colgroup><col> <col></colgroup><thead><tr><th><strong>Field</strong></th><th><strong>Value</strong></th></tr></thead><tbody><tr><td><p><strong>Provider</strong></p></td><td><p>Select <strong>Kong</strong>.</p></td></tr><tr><td><p><strong>Platform</strong></p></td><td><p>Select <strong>Kong Gateway</strong>.</p></td></tr><tr><td><p><strong>Service Type</strong></p></td><td><p><strong>REST APIs</strong> selected by default.</p></td></tr><tr><td><p><strong>Authentication Method</strong></p></td><td><p><strong>Service Account</strong> selected by default.</p></td></tr><tr><td><p><strong>Kong Gateway Region</strong></p></td><td><p>Select the Kong Gateway region.</p></td></tr><tr><td><p><strong>Personal Access Token</strong></p></td><td><p>Enter the personal access token.</p></td></tr></tbody></table>

6.  Click **Test Connection**.

    If the connection fails, review the **Connection Configuration** settings. Update the settings,
    and then test the connection again.

7.  To send email notifications:

    1.  Select **Advanced Settings** and turn on **Send Email Notifications**.

    2.  Enter an email address.

8.  Click **Add Scanner**.

## Protocol to Asset Type Mapping

When the scanner discovers an API in Kong Gateway, it assigns an asset type in Exchange based on the
API’s Kong protocol and plugins. The scanner identifies gRPC APIs by their protocol alone and does
not check plugins for these APIs. For HTTP APIs, the scanner checks the API’s plugins because both
REST and GraphQL APIs use the HTTP protocol. If the API has a `graphql-*` plugin, the scanner
classifies it as a GraphQL API. Otherwise, the scanner classifies it as a REST API.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Protocol</th><th>Plugin</th><th>Asset type</th></tr></thead><tbody><tr><td><p><code>grpc</code> / <code>grpcs</code></p></td><td><p>No matching plugin</p></td><td><p>gRPC</p></td></tr><tr><td rowspan="2"><p><code>http</code> / <code>https</code></p></td><td><p><code>graphql-*</code></p></td><td><p>GraphQL</p></td></tr><tr><td><p>No matching plugin</p></td><td><p>REST</p></td></tr></tbody></table>

The scanner currently detects gRPC and GraphQL protocols only.

> [!NOTE] APIs that use other protocols or plugins, such as Model Context Protocol (MCP), WebSocket,
> or Simple Object Access Protocol (SOAP), are registered in Exchange as asset type REST for now.
> MuleSoft plans to support these protocols in a future release.

## Rescanning Behavior

The scanner assigns an asset type to an API the first time it discovers that API in Exchange. Later
scans do not update that asset type, even if the API’s protocol changes in Kong Gateway. To change
an asset’s type, remove the asset from Exchange, and let the scanner import it again.

## See Also

- [Kong scanners](https://docs.mulesoft.com/exchange/kong-scanners)

- [Discovering and Cataloging External Assets with Scanners](https://docs.mulesoft.com/exchange/discovering-and-importing-external-agents)

- [Managing Scanners](https://docs.mulesoft.com/exchange/managing-scanners)